e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:35

Target

e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
Size

522KB
MD5

4172d6b064aa2de18f1a57ad65288f0a
SHA1

f963ef544adc519fc174b88c312ba8f1fba24f01
SHA256

e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8
SHA512

3d4c1149bb6b6058dccccf070c45fc966ef58d406cb637086a94301e2805c4238cab9b56d1c5c77849a8e424a08b0d9553f56c25a0a51cb5de950239856c7a03
SSDEEP

12288:IXl8lzPjfu+yrHPp8hy18xQqpx8O5vy7:LPzZyrHPkatqpx8H7

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe

description	pid	process	target process
PID 2808 wrote to memory of 864	2808	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
PID 2808 wrote to memory of 864	2808	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
PID 2808 wrote to memory of 864	2808	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
PID 2808 wrote to memory of 2160	2808	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
PID 2808 wrote to memory of 2160	2808	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
PID 2808 wrote to memory of 2160	2808	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe	e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe

C:\Users\Admin\AppData\Local\Temp\e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
"C:\Users\Admin\AppData\Local\Temp\e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
  start
  2⤵
  PID:864
- C:\Users\Admin\AppData\Local\Temp\e92809d2447b64e96f982ef2c72a815b5ea442e66e1c5ef4d79fb3db2c2c5df8.exe
  watch
  2⤵
  PID:2160

memory/864-134-0x0000000000000000-mapping.dmp

Download
memory/864-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/864-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/864-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2160-133-0x0000000000000000-mapping.dmp

Download
memory/2160-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2160-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2160-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2808-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2808-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download